CVE Tracker

CVE-2026-53266 @ Archive

Status
reviewing KEV
Priority
4.32
Match score
4.0
Risk
MemCorrupt priv:user
CVSS
8.8 HIGH
Reason
cpe: linux_kernel; pkgs: linux_kernel; version: in-range: linux_kernel-5.10.191-1; KEV; risk:memory_corruption
Created
2026-09-19T10:15:34Z
Updated
2026-10-20T10:21:01Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
linux_kernel-5.10.191-1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: linux_kernel

No packages matching “linux_kernel” in inventory.

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2025-39964 7.8 KEV morris, mufasa reviewing linux_kernel —
CVE-2024-50302 5.5 KEV Archive, Janus, Library, Saiph new linux_kernel —

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
Debian GNU/Linux 10 (buster) (10) · debian
Arch
x86_64
kernel_release
uname -r → 5.10.0-25-amd64
kernel_version
uname -v → #1 SMP Debian 5.10.191-1 (2023-08-16)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: make ebt_snat ARP rewrite writable

The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0).  This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.

However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:

        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)

skb_header_pointer() only safely reads the ARP header; it does not make
the later sender hardware address range writable.  If that range is
still held in a nonlinear skb fragment backed by a splice-imported file
page, skb_store_bits() maps the frag page and copies the new MAC address
directly into it.

Ensure the ARP SHA range is writable before reading the ARP header and
before calling skb_store_bits().

Determination

Kernel is old; the bug is ebtables SNAT on a bridge, not “any 5.10.” CVE-2026-53266 writes the ARP sender MAC through skb_store_bits() onto a splice-backed frag page. KEV since 2026-09-18. Debian bullseye fix is 5.10.259-1 (DLA-4664-1). You are on 5.10.191-1 (2023-08-16). Version is behind. That is not the same as “this box is exploiting.”

Do not treat KEV + uname 5.10 as “rebuild tonight” unless that ebtables rule exists. Do treat 5.10.191 as overdue on general kernel hygiene. Mitigation if you cannot reboot yet: no ebt_snat on ARP, no unneeded bridges.

Update status

Add note only

Mitigation log

2026-09-22T13:51:05Z — reviewing
Kernel is old; the bug is ebtables SNAT on a bridge, not “any 5.10.” CVE-2026-53266 writes the ARP sender MAC through skb_store_bits() onto a splice-backed frag page. KEV since 2026-09-18. Debian bullseye fix is 5.10.259-1 (DLA-4664-1). You are on 5.10.191-1 (2023-08-16). Version is behind. That is not the same as “this box is exploiting.” Do not treat KEV + uname 5.10 as “rebuild tonight” unless that ebtables rule exists. Do treat 5.10.191 as overdue on general kernel hygiene. Mitigation if you cannot reboot yet: no ebt_snat on ARP, no unneeded bridges.

References

NVD: CVE-2026-53266